CVE-2025-0755
MongoDB C Driver bson library may be susceptible to buffer overflow
The various bson_append functions in the MongoDB C driver library may be susceptible to buffer overflow when performing operations that could result in a final BSON document which exceeds the maximum allowable size (INT32_MAX), resulting in a segmentation fault and possible application crash. This issue affected libbson versions prior to 1.27.5, MongoDB Server v8.0 versions prior to 8.0.1 and MongoDB Server v7.0 versions prior to 7.0.16
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
8.4
MongoDB C Driver bson library may be susceptible to buffer overflow
The various bson_append functions in the MongoDB C driver library may be susceptible to buffer overflow when performing operations that could result in a final BSON document which exceeds the maximum allowable size (INT32_MAX), resulting in a segmentation fault and possible application crash. This issue affected libbson versions prior to 1.27.5, MongoDB Server v8.0 versions prior to 8.0.1 and MongoDB Server v7.0 versions prior to 7.0.16
- Record
CVE-2025-0755- CVSS 3.1
- 8.4 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-122
- Updated
- 2026-11-02
EUVDEUVD-2025-6467
8.4
The various bson_append functions in the MongoDB C driver library may be susceptible to buffer overflow when performing operations that could result in a final BSON document which exceeds the maximum allowable size (INT32_MAX), resulting in a segmentation fault and possible application crash. This issue affected libbson versions prior to 1.27.5, MongoDB Server v8.0 versions prior to 8.0.1 and MongoDB Server v7.0 versions prior to 7.0.16
- Record
EUVD-2025-6467- CVSS 3.1
- 8.4 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-x43h-8pfv-xx24
8.4
The various bson_append functions in the MongoDB C driver library may be susceptible to buffer...
The various bson_append functions in the MongoDB C driver library may be susceptible to buffer overflow when performing operations that could result in a final BSON document which exceeds the maximum allowable size (INT32_MAX), resulting in a segmentation fault and possible application crash. This issue affected libbson versions prior to 1.27.5, MongoDB Server v8.0 versions prior to 8.0.1 and MongoDB Server v7.0 versions prior to 7.0.16
- Record
GHSA-x43h-8pfv-xx24- CVSS 3.1
- 8.4 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-122
- Updated
- 2026-11-02
NVD
8.4
The various bson_append functions in the MongoDB C driver library may be susceptible to buffer overflow when performing operations that could result in a final BSON document which exceeds the maximum allowable size (INT32_MAX), resulting in a segmentation fault and possible application crash. This issue affected libbson versions prior to 1.27.5, MongoDB Server v8.0 versions prior to 8.0.1 and MongoDB Server v7.0 versions prior to 7.0.16
- Record
CVE-2025-0755- CVSS 3.1
- 8.4 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-122
- Updated
- 2026-11-02
OSV
8.4
MongoDB C Driver bson library may be susceptible to buffer overflow
The various bson_append functions in the MongoDB C driver library may be susceptible to buffer overflow when performing operations that could result in a final BSON document which exceeds the maximum allowable size (INT32_MAX), resulting in a segmentation fault and possible application crash. This issue affected libbson versions prior to 1.27.5, MongoDB Server v8.0 versions prior to 8.0.1 and MongoDB Server v7.0 versions prior to 7.0.16
- Record
CVE-2025-0755- CVSS 3.1
- 8.4 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-122
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2025-0755
7.5
The various bson_append functions in the MongoDB C driver library may be susceptible to buffer overflow when performing operations that could result in a final BSON document which exceeds the maximum allowable size (INT32_MAX), resulting in a segmentation fault and possible application crash. This issue affected libbson versions prior to 1.27.5, MongoDB Server v8.0 versions prior to 8.0.1 and MongoDB Server v7.0 versions prior to 7.0.16
- Record
DEBIAN-CVE-2025-0755- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2025-0755
8.4
The various bson_append functions in the MongoDB C driver library may be susceptible to buffer overflow when performing operations that could result in a final BSON document which exceeds the maximum allowable size (INT32_MAX), resulting in a segmentation fault and possible application crash. This issue affected libbson versions prior to 1.27.5, MongoDB Server v8.0 versions prior to 8.0.1 and MongoDB Server v7.0 versions prior to 7.0.16
- Record
UBUNTU-CVE-2025-0755- CVSS 3.1
- 8.4 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVBIT-mongodb-2025-0755 No score
MongoDB C Driver bson library may be susceptible to buffer overflow
The various bson_append functions in the MongoDB C driver library may be susceptible to buffer overflow when performing operations that could result in a final BSON document which exceeds the maximum allowable size (INT32_MAX), resulting in a segmentation fault and possible application crash. This issue affected libbson versions prior to 1.27.5, MongoDB Server v8.0 versions prior to 8.0.1 and MongoDB Server v7.0 versions prior to 7.0.16
- Record
BIT-mongodb-2025-0755- Updated
- 2026-11-02
OSVUSN-7613-1 No score
mongo-c-driver vulnerabilities
Karman Liu discovered that mongo-c-driver did not correctly handle certain memory operations. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2024-6381)
Karman Liu discovered that mongo-c-driver did not correctly handle certain memory operations. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 24.04 LTS. (CVE-2024-6383, CVE-2025-0755)
- Record
USN-7613-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
mongodbBitnami |
7.0.0 up to 7.0.16, 8.0.0 up to 8.0.1 | 7.0.168.0.1 |
libbson-xs-perlDebian:12 |
before 0.8.4-2+deb12u1, plus listed versions 0.8.4-2 |
0.8.4-2+deb12u1 |
mongo-c-driverDebian:12 |
before 1.23.1-1+deb12u1, plus listed versions 1.23.1-1 |
1.23.1-1+deb12u1 |
mongo-c-driverDebian:13 |
before 1.27.5-1 | 1.27.5-1 |
mongo-c-driverDebian:14 |
before 1.27.5-1 | 1.27.5-1 |
libbson-xs-perlDebian:11 From an advisory covering 6 CVEs |
before 0.8.4-1+deb11u1, plus listed versions 0.8.4-1 |
0.8.4-1+deb11u1 |
mongo-c-driverDebian:11 From an advisory covering 5 CVEs |
before 1.17.6-1+deb11u1, plus listed versions 1.17.6-1 |
1.17.6-1+deb11u1 |
mongo-c-driverUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 1.15.0-11.15.1-11.15.2-11.16.0-11.16.1-11.16.1-1build11.16.1-1build21.16.1-1ubuntu0.1~esm1 |
None known |
mongo-c-driverUbuntu:22.04:LTS |
All versions, plus listed versions 1.18.0-11.19.1-11.19.2-11.20.0-11.20.0-1build11.20.1-11.21.0-11.21.0-1build1 |
None known |
mongo-c-driverUbuntu:Pro:24.04:LTS |
before 1.26.0-1.1ubuntu2+esm1, plus listed versions 1.24.3-11.24.4-11.25.1-11.25.2-11.25.4-11.26.0-11.26.0-1.1ubuntu11.26.0-1.1ubuntu2 |
1.26.0-1.1ubuntu2+esm1 |
mongo-c-driverUbuntu:Pro:20.04:LTS From an advisory covering 3 CVEs |
before 1.16.1-1ubuntu0.1~esm1, plus listed versions 1.15.0-11.15.1-11.15.2-11.16.0-11.16.1-11.16.1-1build11.16.1-1build2 |
1.16.1-1ubuntu0.1~esm1 |
mongo-c-driverUbuntu:Pro:22.04:LTS From an advisory covering 3 CVEs |
before 1.21.0-1ubuntu0.1~esm1, plus listed versions 1.18.0-11.19.1-11.19.2-11.20.0-11.20.0-1build11.20.1-11.21.0-11.21.0-1build1 |
1.21.0-1ubuntu0.1~esm1 |
mongo-c-driverUbuntu:Pro:24.04:LTS From an advisory covering 3 CVEs |
before 1.26.0-1.1ubuntu2+esm1, plus listed versions 1.24.3-11.24.4-11.25.1-11.25.2-11.25.4-11.26.0-11.26.0-1.1ubuntu11.26.0-1.1ubuntu2 |
1.26.0-1.1ubuntu2+esm1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-0755 is a high vulnerability (CVSS 8.4) in Mongodb Libbson, published March 18, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.79%, the 56th percentile. Fixed in mongodb 7.0.16.
References
jira.mongodb.org/browse/SERVER-94461
jira.mongodb.org/browse/CDRIVER-5601
lists.debian.org/debian-lts-announce/2025/05/msg00027.html
lists.debian.org/debian-lts-announce/2025/05/msg00012.html
nvd.nist.gov/vuln/detail/CVE-2025-0755
github.com/advisories/GHSA-x43h-8pfv-xx24